CVE-2024-7990

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-7990

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7990.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-7990

Aliases

Published

2025-03-20T10:08:55.590Z

Modified

2026-07-15T01:48:58.433122267Z

Severity

8.4 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

Stored Cross-Site Scripting in open-webui/open-webui

Details

A stored cross-site scripting (XSS) vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious scripts that can be executed by any user, including administrators, potentially leading to arbitrary code execution.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7990.json",
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "@huntr_ai"
}

References

Affected packages

Git / github.com/open-webui/open-webui

Affected ranges

Type

GIT

Repo

https://github.com/open-webui/open-webui

Events

Introduced

9bcd4ce5c0a01af68c0d2aa44554a68bb741c61b

Last affected

9bcd4ce5c0a01af68c0d2aa44554a68bb741c61b

Database specific

{
    "cpe": "cpe:2.3:a:openwebui:open_webui:0.3.8:*:*:*:*:*:*:*",
    "source": "CPE_STRING",
    "extracted_events": [
        {
            "introduced": "0.3.8"
        },
        {
            "last_affected": "0.3.8"
        }
    ]
}

Affected versions

0.*

0.3.8

v0.*

v0.3.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-7990.json"